Quote from: 3e on April 28, 2021, 11:01:18 AM

Hi Guys
I just find this web page after buying wallet that is in circulation for last 2 weeks. That refers to address 1KTvsW5tg5gkJf9fyT2xsvjkv7dzuZNTpW& - lost my 120 USD.
I also have downloaded free wallets from wallets-dat.com and wallets-dat.net that seems to be operated by the same person - I bought mine form wallets-dat.net link.

Also, I have analyzed fake wallets (posted here) with password given. Normally entering password causes bitcoin client to crash. However little changes to its source code allows me work with it and what I found interesting. You can get some private keys for just few of accounts - that are empty anyway.

However dumping private keys for accounts that are referenced as holding coins - simply have not private keys included at all - client returns error.

Code:

12:44:56 dumpprivkey "bc1qezvgjmmy206ry4yphdzssuewzhvzcyjrr0uuw0"
12:44:56 L41CAZgxDSbeXGzAqQDs4UAxfR8W3vUS74LR6c8WtQ84syy66ySJ

12:45:02 dumpprivkey "3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs"
12:45:02 L35Mp47gDsd8NRHw91AXbvyohM7zPZS73TZ3LZHZnfdRB4UeTmeP

12:45:17 dumpprivkey "1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1"
12:45:17 Private key for address 1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1 is not known (code -4)

12:46:20 dumpprivkey "12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX"
12:46:20 Private key for address 12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX is not known (code -4)

What I conclude from that is, if we just had an tool that is capable to check if accounts have private keys at all defined (in encrypted format) then we can at least filter some of forged wallets.

On the other hand, forger may be able to put some rubbish as a private key. I do not know exact structure of wallet file - I just invest about 1-2h to figure out if I can extract some additional information -
maybe it is not possible to create well forged fake.

Hence forging might be done as one of 2 ways:
- Injecting fake transactions referencing to forgotten account to existing wallet.
- Injecting fake account without or broken private keys.
- Striping private keys out of wallet that literally has originally holded them.

Having that tool may save lot of time for cracking. And at least allow to figure out if it make sense to work on them.

hello
I don't know if you've looked closely at the previous posts, but one way to tell if it's real is to look at the timestamp generated by the pool without any tools. This can filter out a lot of fake wallets.

yangxin325

Posts

Merits